External risk intelligence

Dokploy SSH Key Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72740

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments. Such systems are typically deployed as internet-facing management surfaces or web-based dashboards to facilitate remote service administration and deployment pipelines, making the interface and its associated backend services commonly accessible in network-reachable environments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Dokploy, a self-hostable Platform as a Service, that could allow authenticated users to execute arbitrary commands on the host system during deployment. This issue arises from improper handling of user-supplied repository URLs within the deployment process.

Command execution via custom Git URLs.
Affects self-hosted application deployment platforms.
Confirm relevance and exposure of this PaaS tool.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access and deployment permissions could craft a malicious Git URL. This URL, when used during a service deployment, would be improperly handled, leading to the execution of arbitrary commands on the host system.

Authenticated member with deployment permission.
User-controlled custom Git URL.
Arbitrary command execution on host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated member with deployment permissions could execute arbitrary commands on the Dokploy host when deploying a service if a specially crafted custom Git URL is provided. This could impact the Dokploy host's integrity and availability.

Dokploy host system integrity.
Arbitrary command execution via crafted URL.
Compromise of deployed service environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts self-hosted Dokploy instances where authenticated users can execute arbitrary commands on the host system through crafted `customGitUrl` values during deployment. Responsibility likely lies with the platform or infrastructure team managing the Dokploy deployment, in coordination with the application owners who utilize the service. The first practical step is to identify all Dokploy instances, assess their exposure and criticality, and then plan remediation by upgrading to the fixed version or implementing compensating controls.

Platform/Infrastructure team owns the issue.
Verify Dokploy instance reachability and criticality.
Plan upgrade or implement mitigating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a free, self-hostable Platform as a Service (PaaS). It functions as a centralized management hub that simplifies how developers deploy, monitor, and manage applications and services on their own infrastructure, often replacing the need for complex, hosted cloud provider consoles.

What does CVE-2026-72740 mean for system security?

This vulnerability is classified as CWE-78, or OS Command Injection. It occurs when an application improperly filters input before passing it to a system shell. In this case, Dokploy fails to safely handle custom Git repository URLs, allowing an attacker to inject and execute unauthorized commands directly on the host server where the PaaS is running.

How can an attacker trigger this vulnerability?

The flaw is triggered during the deployment process when a user with service deployment permissions provides a specially crafted custom Git URL. It is important to note that this does not occur during routine, standard repository interactions; it specifically requires the manipulation of the input that the system uses to verify SSH host keys.

Is my Dokploy instance at risk?

Halo Surface Signal indicates that Dokploy is often deployed as an internet-facing management dashboard to allow for remote service administration. Because it is designed to be network-reachable, any instance accessible over the internet is a higher priority for review than those restricted to internal, private networks.

How do I fix this vulnerability?

The vulnerability is resolved in Dokploy version 0.29.13. You should prioritize upgrading your self-hosted Dokploy instance to this version or newer. If an immediate upgrade is not feasible, restrict deployment permissions to trusted users only and monitor service deployment activity for unusual Git URL inputs until you can patch the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.